SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection (CVE-2025-2776)

What is affected, what to do

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• SysAid On-Prem lte *..23.3.40

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory and exposure check: Identify every SysAid On-Prem instance and record its version. All releases up to and including 23.3.40 are affected. Confirm whether the web UI or the MDM endpoints are reachable from the internet, using Shodan/Censys lookups of your ranges and reverse-proxy configs.
   • Patch: Upgrade to a release later than 23.3.40. A patch is available from the vendor — look up the exact fixed version in the SysAid vendor advisory. Snapshot or back up the server first; the snapshot doubles as forensic preservation.
   • Cut internet exposure now: Until patched, restrict the SysAid web interface to internal networks or VPN at the firewall or reverse proxy. Block unauthenticated /mdm/ paths at the perimeter unless MDM genuinely requires external reach. Public research ties this flaw to the server URL handler (/mdm/serverurl).
   • Rotate credentials: Treat any previously exposed instance as compromised. Reset all SysAid administrator passwords and invalidate sessions. Rotate the database and service-account secrets stored in config files on the server. The XXE file-read primitive can pull such files; public write-ups describe an initialisation file holding the plaintext admin password (InitAccount.cmd).
   • Kick off compromise assessment: Preserve web and Tomcat logs covering recent weeks. Review the SysAid admin account list for new or modified accounts and audit configured automations and scripts. Admin takeover is typically the first link in a chain that can end in code execution.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move the SysAid server into a dedicated management segment. Allow inbound traffic only from client networks and admin jump hosts. Default-deny all outbound internet traffic from the server. This kills out-of-band XXE, where data is exfiltrated via external DTDs or HTTP/FTP callbacks.
   • WAF/IPS rule: Block POSTs to /mdm/* whose body contains <!DOCTYPE, <!ENTITY, SYSTEM " or PUBLIC ". Suricata idea: http.method; content:"POST"; http.uri; content:"/mdm/"; http.request_body; content:"<!ENTITY"; nocase;. Enable generic XXE rule sets (e.g. OWASP CRS) for this vhost.
   • Authenticating reverse proxy: If external access is unavoidable, front the app with pre-authentication (SSO/mTLS) so unauthenticated requests never reach it.
   • Endpoint hardening: Run the SysAid service (Java/Tomcat) under a least-privilege service account, not SYSTEM/root. Lock down filesystem ACLs on config and credential files. Enable EDR rules for child processes of the Java process (cmd.exe, powershell.exe, sh).
   • IAM: Enforce MFA or SSO for SysAid admins where supported. Minimise the number of admin accounts and disable default or initial local accounts.
3. 03

   Runbook step 3

   Detection rules

   • Web/Tomcat access logs: POSTs to /mdm/serverurl (and other /mdm/ paths) from external or atypical source IPs, especially with unusual body sizes. SPL: index=web uri_path="/mdm/*" method=POST | stats count by src_ip, uri_path. If request bodies are logged, also search for <!ENTITY or SYSTEM.
   • Network telemetry (Zeek/firewall): Outbound HTTP, FTP or DNS from the SysAid server to unfamiliar external hosts, time-correlated with inbound /mdm/ requests. This is the classic out-of-band XXE pattern (fetch external DTD, exfiltrate data). Zeek: http.log where id.orig_h == <sysaid_ip> and user agent Java/*.
   • Sysmon/EDR: Sysmon EID 3 with Image ending in java.exe or tomcat*.exe connecting to external destinations. Sysmon EID 1 with ParentImage set to the Java/Tomcat process and Image in (cmd.exe, powershell.exe, whoami.exe) signals follow-on code execution. Sigma shape: ParentImage|endswith: '\java.exe' and Image|endswith: ['\cmd.exe','\powershell.exe'].
   • Application and audit logs: SysAid admin logins from new IPs or outside business hours, shortly after suspicious /mdm/ requests. New admin accounts, role changes, and modifications to system settings or integrations. Windows EID 4663 (with object auditing enabled) for service-account reads of credential or init files.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• SysAid Sysaid
• SysAid Sysaid On-prem

Weakness classes (CWE)

• CWE-611Improper Restriction of XML External Entity Reference

  Base

  The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

  Entry at MITRE CWE-611

References & sources

• documentation.sysaid.comSysAid advisory: SysAid On-PremVendor advisory, Release notes, pwn-watch
• labs.watchtowr.comsysowned-your-friendly-rce-support-ticketExploit, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-2776government-resource, US government resource
• pwn.watchpwn.watch: SysAid On-Prem: 2 exploited vulnerabilities (CVE-2025-2775, CVE-2025-2776)pwn-watch
• NVD (NIST)NVD: CVE-2025-2775pwn-watch
• NVD (NIST)NVD: CVE-2025-2776pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch